Is it possible to fully encrypt an iPhone? What cipher does it use and are there any weaknesses?
How can I protect my valuable data, such as email, when my iPhone gets stolen?
asked Sep 4, 2012 at 15:54
Add a comment
|
2 Answers
iOS4 has introduced (a somewhat secure) Full Disk encryption for the iPhone. The encryption itself is done by hardware and uses AES-256 to encrypt your data.
An iPhone has two partitions:
- System data
- User data
The user data part gets encrypted with an AES-256 if enabled. The key for this is a passcode you must enter every time you want to unlock your phone. This ensures the data partition cannot be decrypted in an easy way. So if your phone gets stolen and the attacker doesn't have the passcode, he can't access your personal data.
The problem here is that's what Apple is telling us. There is a VERY BIG BUT that's following now.
Security researchers found out that the all of this security can be bypassed by a device that speaks the Apple control protocol. Also there seems to be a problem that all of this can be bypassed if you are able to Jailbreak the phone. The problem with this option is that the iPhone itself needs to be paired prior to a computer prior to be able to do the Jailbreak (if there is a way to bypass this please leave a comment). When the phone is Jailbroken an attacker can install an SSH daemon and just take a raw copy of all your data...unencrypted now.
If the above is fixed by Apple, you would have a reasonble secure device. So to protect your data you will need some extra apps that allow you to remotely whipe your iPhone and secure your emails safely.
Now besides all that is also nice to note that Apple has provided a complete Security API for developers. They can use it to produce Apps that can securely encrypt just about anything. Unfortunately, there are few Apps using it.
Email clients:
- GOOD for enterprise
- Integrated Email client (apparently should encrypt all emails too, but I could be wrong if it relies on the same hardware security)
Wiping:
- When using Exchange push email you can do this through the exchange client (for your email)
- using iCloud, it has a feature to locate your iPhone and wipe it.
This are just some features and there are probably a lot more, so please feel free to share the knowledge and correct me if I'm wrong.
answered Sep 4, 2012 at 15:54
-
Could you reference the research about bypassing the iOS encryption on jail-broken devices? I don't understand how this is possible if (as Apple state) the disk encryption key is not stored on the device but is calculated as a function of the passcode. Sep 6, 2012 at 15:43
-
-
The Wired article is from 2009. iOs 4 is from 2010. I'm not aware of any such attacks on the iOs disk encryption. Sep 10, 2012 at 19:16
The problem here is that if you base your data security on the apple monolithic architecture (which is a good start) then you will be at risk when that architecture fails.
So the question you have to ask yourself is: "What happens when the device is jailbroken?"
A defence in depth approach would be to use Apple's APIs, but also to add your own independent layer. This of course would be based on your risk assessment of the data you store on the device.
Just in case.
